14f548d1e789109e9104fd7213cb1725dfbcb90bc1fc8876277df334a32063e5

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 531KB
Sample260715-kcrbpaa13w
SHA256 14f548d1e789109e9104fd7213cb1725dfbcb90bc1fc8876277df334a32063e5
MD5 10ce880ab875f550290f855f564801b3
SHA1 eec6d8aa677fcab1a2026490982533f7c6a4b4e6
SHA512 b34dc245b86e3b8079624246e22cafc9aa16f3b5c1d9fb825d803933dda152c20a1a82dc9fa66e718f17098667c5cb349ea9c59aa05552a8d6379a6cf96aa73f
SSDEEP 12288:KdcAIffrC9fdm7nasRW4s7rga46d8VFcE3tN7fn5nPmR:KdpInm9fdmuMs3DJeAwtRn5PmR
TLSH
T1C5C4F15175C281B2D08614331A5BC7B22C3A39354B29AEC776D4B7BDBD317C266B232B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3404	DA2E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3404	DA2E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA2E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3404	DA2E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3404	1164	2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\DA2E.tmp
  "C:\Users\Admin\AppData\Local\Temp\DA2E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-15_10ce880ab875f550290f855f564801b3_amadey_elex_remcos_rhadamanthys_smoke-loader.exe CFA6C63617F53848105EC0F94B2281FC986D25601A97149F0E264891AEF01C2622D50F91CC8FC43D36BADEDC4D9352F6580EE6A85C366A5B4559E5D00EBE2F69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DA2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\DA2E.tmp
Size 531KB
SHA256 afb7c7001bb3f1c92f2a068566f1de0dc2d8a6c2ef2a1acfbe5b041726834787
MD5 526af6f1b61ea830e1ff58fd309135a8
SHA1 dc45bea3ee780824c5dc700782422f6dc2c91a95
SHA512 1bcab53143844a6f154151b94faf87eeff29b435852d9989a610a342eba2acba341b30e1ce86b622b7e9a5e7b51b65d959725d533cc9474560467c0a084146b5
SSDEEP 12288:KdcAIffrC9fdm7naBWcLbxd3nWFPN7fn5nPmR:KdpInm9fdmuBBLbxd3nORn5PmR
TLSH
T1E9C4F16165C3C272D08704331AABCBB26C7A39304B296EC776D4777DAD706C2A6B531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads